                                    (.getPublicKey (utils/pem->ca-cert cacert cakey))
                                    serial)
         new-full-chain (cons new-full-crl (vec rest-of-full-chain))]
-    (ks-file/atomic-write cacrl (partial utils/objs->pem! new-full-chain))
+    (write-crls new-full-chain cacrl)
     (log/debug (i18n/trs "Revoked {0} certificate with serial {1}" subject serial))
 
     ;; Publish infra-crl if an infra node is getting revoked.

                                      private-key
                                      public-key)]
    (write-cert-to-inventory! cacert (:cert-inventory ca-settings))
    (ks-file/atomic-write (:capub ca-settings) (partial utils/key->pem! public-key) public-key-perms)
    (ks-file/atomic-write (:cakey ca-settings) (partial utils/key->pem! private-key) private-key-perms)
    (ks-file/atomic-write (:cacert ca-settings) (partial utils/cert->pem! cacert) public-key-perms)
    (ks-file/atomic-write (:cacrl ca-settings) (partial utils/crl->pem! cacrl) public-key-perms)
    (ks-file/atomic-write (:infra-crl-path ca-settings) (partial utils/crl->pem! infra-crl) public-key-perms)))

(schema/defn split-hostnames :- (schema/maybe [schema/Str])
  "Given a comma-separated list of hostnames, return a list of the

    {:not-before (.toDate not-before)
     :not-after  (.toDate not-after)}))


(schema/defn settings->cadir-paths
  "Trim down the CA settings to include only paths to files and directories.
  These paths are necessary during CA initialization for determining what needs
